Signature.check_signature_policy/2 requires date or (created) to be
signed and within signature_max_age (2 h) / signature_max_clock_skew
(1 h), and requires a signed, hashed digest for requests with a body.
Based on Akkoma's http_signatures fork (required headers, max_sig_age)
and Mastodon's SignedRequest (clock skew margin).
Public activities went to every inbox, so followers on an instance in
the SimplePolicy reject list still got our posts. With authorized fetch
mode on, signed fetches from those instances were also accepted, unless
the instance was in :instance, :rejected_instances too.
Check the SimplePolicy reject and accept lists for deliveries and signed
fetches, when the policy is enabled. Quarantine keeps its meaning (no
private activities). An inbox without a host no longer crashes.
Based on the Akkoma changes 90c4785b8, ca000f830, 03662501c and d2b0d8647.
Co-authored-by: FloatingGhost <hannah@coffee-and-dreams.uk>
Co-authored-by: Atsuko Karagi <atsuko.karagi@localhost>
Hackney 4 reads every response completely before Pleroma can check its
size, so max_body no longer limits downloads or memory there; Gun stops
at the limit. Document the Hackney limitation for those who switch back.
Elixir 1.19 started emitting warnings about our use of:
config :logger, :console and
config :logger, backends: []
which got split in 1.15 to :default_handler, :default_formatter, and
LoggerBackends.add(backend) respectively.
On Pleroma startup it is now necessary to add the additional logger
backends at runtime (done with configure_logger() in application.ex).
New config key :pleroma, :logger_backends: [] has replaced the older
backends array. The logger_backends package is now used to facilitate
usage of other logger backends besides the default one (:logger_std_h
from OTP).
Warnings were added to Pleroma startup to warn about the usage of
:logger, backends and additional logic was introduced to make addition
of ExSyslogger to admin's configuration less dumb.
Ref: https://hexdocs.pm/logger/1.15.0/Logger.html#module-backends-and-backwards-compatibility
Update docs to clarify that the :ssl option is also for modern TLS, but the :tls option is only for STARTTLS
These options may benefit from being renamed but they match upstream terminology.
